feat(docker): publish ccs:latest + ccs:full integrated images (P1 of #1251) (#1257)

* feat(docker): parameterize Dockerfile.integrated with ARG FLAVOR=minimal|full

Add FLAVOR build arg that gates the AI CLI install layer (claude-code,
gemini-cli, grok-cli, opencode) so one Dockerfile produces both the
minimal (< 350 MB) and full (< 600 MB) integrated images.

Use BuildKit cache mount for /root/.npm to speed up repeated builds.
Part of #1251 (P1 — publish integrated images).

* feat(docker): emit startup deprecation warning in legacy ccs-dashboard entrypoint

Prepend a [WARN] line to stderr on every container start so operators
running ghcr.io/kaitranntt/ccs-dashboard:latest are notified to migrate
to ghcr.io/kaitranntt/ccs:latest. Sunset window: 2 releases. See #1251.

* test(docker): add image-size.sh budget assertion + unit test suite

image-size.sh: asserts docker image inspect .Size against a byte budget.
  Usage: image-size.sh <image:tag> <max-bytes>
  Budgets: minimal=350 MB (367001600), full=600 MB (629145600)

image-size-logic.test.sh: 6 mock-docker unit tests covering pass/fail
boundaries, bad arg count, and non-integer input. All 6 pass locally.
Part of #1251 (P1).

* ci(docker): extend docker-release.yml to publish ccs:latest and ccs:full

- Add publish-integrated job with matrix flavor: [minimal, full]
  - minimal -> ghcr.io/kaitranntt/ccs:<ver> + :latest (when promoted)
  - full    -> ghcr.io/kaitranntt/ccs:full-<ver> + :full (when promoted)
  - Multi-arch: linux/amd64 + linux/arm64 via buildx
  - Scoped GHA cache per flavor to avoid cross-contamination

- Add promote_to_latest workflow_dispatch input (default false)
  - rc.1 soak: first publish only pushes immutable version tag
  - Mutable :latest/:full promoted only on release event OR explicit opt-in

- Add smoke-test job (post-publish) for each flavor
  - Pulls the just-published version tag
  - Asserts image size via tests/docker/image-size.sh
  - Boots container, waits for healthcheck, probes :3000 and :8317

- Keep publish-dashboard job unchanged (legacy 2-release sunset)
  - Updated labels to note deprecation status

All jobs run on self-hosted cliproxy runners. Part of #1251 (P1).

* docs(docker): document new image tags, add ccs-dashboard deprecation notices

docker/README.md:
- Add "Choosing an image" table (ccs:latest / ccs:full / ccs-dashboard deprecated)
- Update Quick Start section to use ccs:latest as primary example
- Add legacy image note with sunset timeline

CHANGELOG.md:
- Add Unreleased > ### Deprecated entry for ccs-dashboard:latest
  pointing to migration path and #1251

README.md:
- Add one-line deprecation banner near top routing users to ccs:latest

Part of #1251 (P1).

docker/Dockerfile.integrated

@@ -1,17 +1,32 @@
 FROM eceasy/cli-proxy-api:latest
 
 ARG CCS_NPM_VERSION=latest
+# FLAVOR=minimal installs CCS only; FLAVOR=full adds claude-code, gemini-cli, grok-cli, opencode
+ARG FLAVOR=minimal
 
 RUN apk add --no-cache \
+    bash \
     curl \
     jq \
     nodejs \
     npm \
     supervisor
 
-RUN npm install -g @kaitranntt/ccs@${CCS_NPM_VERSION} \
+# Install CCS CLI (always present in both flavors)
+RUN --mount=type=cache,target=/root/.npm \
+    npm install -g @kaitranntt/ccs@${CCS_NPM_VERSION} \
   && ln -sf /usr/local/lib/node_modules/@kaitranntt/ccs/dist/docker/docker-bootstrap.js /usr/local/bin/ccs-docker-bootstrap
 
+# Install AI CLIs only in the full flavor (all 4 bundled as one layer)
+RUN --mount=type=cache,target=/root/.npm \
+    if [ "$FLAVOR" = "full" ]; then \
+      npm install -g --ignore-scripts \
+        @anthropic-ai/claude-code \
+        @google/gemini-cli \
+        @vibe-kit/grok-cli \
+      && curl -fsSL https://opencode.ai/install | sh -s -- --no-modify-path 2>/dev/null || true; \
+    fi
+
 COPY supervisord.conf /etc/supervisord.conf
 COPY entrypoint-integrated.sh /entrypoint-integrated.sh
 

docker/README.md

@@ -13,6 +13,16 @@ Persistent config, restart on reboot.
 
 <br>
 
+## Choosing an image
+
+| Tag | Use | Approx. size | Status |
+|---|---|---|---|
+| `ghcr.io/kaitranntt/ccs:latest` | CCS + CLIProxy, no AI CLIs pre-installed | < 350 MB | **Recommended** |
+| `ghcr.io/kaitranntt/ccs:full` | CCS + CLIProxy + claude-code + gemini-cli + grok-cli + opencode | < 600 MB | Supported |
+| `ghcr.io/kaitranntt/ccs-dashboard:latest` | Legacy all-in-one image | > 600 MB | **Deprecated** — migrate to `ccs:latest`. Sunset after 2 releases. See [#1251](https://github.com/kaitranntt/ccs/issues/1251) |
+
+Both `ccs:latest` and `ccs:full` also publish pinned version tags (`ccs:<major>.<minor>.<patch>`, `ccs:<major>.<minor>`, `ccs:<major>`) for reproducible deployments. The `:full` variants carry the `full-` prefix: `ccs:full-<ver>`, `ccs:full-<minor>`, etc.
+
 ## Preferred: `ccs docker`
 
 The CLI now ships a first-class Docker command suite for the integrated CCS + CLIProxy stack:
@@ -147,24 +157,38 @@ Expected healthy output:
 
 ## Prebuilt Image Quick Start
 
-This existing image still runs the CCS dashboard and its locally managed CLIProxy inside one
-container. It does not provide the remote staging and in-container self-update flow exposed by
-`ccs docker`.
-
-Pull the latest stable release image from GitHub Container Registry:
+Pull the recommended minimal image (CCS + CLIProxy, no AI CLIs):
 
 ```bash
 docker run -d \
-  --name ccs-dashboard \
+  --name ccs \
   --restart unless-stopped \
   -p 3000:3000 \
   -p 8317:8317 \
   -e CCS_PORT=3000 \
-  -v ccs_home:/home/node/.ccs \
-  ghcr.io/kaitranntt/ccs-dashboard:latest
+  -v ccs_home:/root/.ccs \
+  ghcr.io/kaitranntt/ccs:latest
 ```
 
-Release-tag images are also published as `ghcr.io/kaitranntt/ccs-dashboard:<version>`.
+Or pull the full image with all 4 AI CLIs pre-installed:
+
+```bash
+docker run -d \
+  --name ccs \
+  --restart unless-stopped \
+  -p 3000:3000 \
+  -p 8317:8317 \
+  -e CCS_PORT=3000 \
+  -v ccs_home:/root/.ccs \
+  ghcr.io/kaitranntt/ccs:full
+```
+
+Release-tag images are published as `ghcr.io/kaitranntt/ccs:<version>` (minimal) and `ghcr.io/kaitranntt/ccs:full-<version>` (full).
+
+### Legacy image (deprecated)
+
+The `ghcr.io/kaitranntt/ccs-dashboard:latest` image continues building for 2 more releases but
+emits a deprecation warning on startup. Migrate to `ccs:latest` at your earliest convenience.
 
 ## Prebuilt Image Build Locally
 

docker/entrypoint.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+echo "[WARN] ghcr.io/kaitranntt/ccs-dashboard is deprecated. Migrate to ghcr.io/kaitranntt/ccs:latest. See https://github.com/kaitranntt/ccs/issues/1251" >&2
+
 ccs_home_dir="${CCS_HOME_DIR:-/home/node/.ccs}"
 
 mkdir -p "$ccs_home_dir"